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INTERVIEW SUMMARY 



Dear Examiner Colin: 

In light of the interview on 11 May 2009, please find an interview 
summary below. 

Identification of Claims and Reference Discussed 

Claim(s) for discussion: 1 and 8 

Reference(s) for discussion: Porras et al. (U.S. Pub. No. 2004/0010718, 
hereinafter "Porras"), Pruthi et al. (U.S. Patent No. 7,492,720, hereinafter 
"Pruthi"), and Cooper et al. (U.S. Patent No. 7,047,288, hereinafter "Cooper"). 

Applicant's Arguments 

With respect to claim 8, Applicant submits that the new service alert rule 
in the present system is specific to whether a host is providing or using a new 
service. The main reference used in the Office Action, Porras, does not 
distinguish between hosts that a providing a new service and hosts that are using 
or consuming the new service. 

With respect to claim 1, Applicant has redrafted the claim to more clearly 
represent the UI depicted in FIG. 10 of the instant application. Applicant will 
explain the functions of each field of this UI in more details during the phone call. 
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Proposed Amendment: 

1 1 . (Currently amended) A graphical user interface rendered on a display 

2 device the graphical user interface for configuring a new service detection 

3 process alert rule , the graphical user interface comprising: 

4 a first field that depicts choices for cntitics allows a user to specify an 

5 entity to track in the network; 

6 a second field that allows the user to specify a system to track if the 

7 selected entity is providing or consuming a service whether the rule is to be 

8 applied when the specified entity is providing or consuming a new service ; 

9 a third field that depicts a range over which to track an entity selected in 

10 the - first fiol d allows the user to specify a range of network entities to which the 

1 1 new service is unprecedented ; and 

12 a fourth field that allows the user to specify a severity for an alert 

13 generated if a new service is detected. 

1 8. (Currently amended) A method for detection of a new service involving 

2 host in a network, the method comprises: 

3 retrieving a baseline list of port and/or service protocols used by a host 

4 being tracked, the baseline list listing service and/or port protocols used by that 

5 host over a baseline period that is of a longer duration tha^ -than a current period; 

6 retrieving a current list of service and/or port protocols for the current 

7 period used by the host being tracked; 

8 determining whether there is a difference in the protocols, by finding a 

9 protocol that was in the current list but was not in the baseline list; and if there is 

10 a difference; 

11 determining whether the host is providing or using the new service; 
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12 identifying an alert rule corresponding to whether the host is providing or 

13 using the new service; and 

14 issuing an alert based at least on the identified alert rule indicating a new 

15 service involving the tracked host. 



Interview Summary 

Examiner suggested clarifying claim 1 so that it recites a system with a display 
device. Examiner suggested clarifying that the alert is issued based on whether 
the service is provided or used as specified in the user's input in the second field. 



Respectfully submitted, 



By /Shun Yao/ 
Shun Yao 

Registration No. 59,242 
Date: 13 July 2009 

Shun Yao 

Park, Vaughan & Fleming LLP 
2820 Fifth Street 
Davis, CA 95618-7759 
Tel: (530) 759-1667 
Fax: (530) 759-1665 
Email: shun@parklegal.com 
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